WebInspect - Persistent XSS Vulnerable Sessions Verified and Reflection Audited - How to Enable

[bn_pep]

In the WebInspect scan visualization, there two status bars, "Verified" and "Reflection Audited". These never show any activity other than something similar to "Verified: 0 of 200". 

We typically use the "Standard" scan policy with WebInspect. We are using version 19.2.

How are these checks enabled so that the Persistent and Reflected XSS are retested and audited?

Thanks!

[ebell]

According to the documentation, here is a description of those values:

Verified

Number of persistent XSS vulnerable sessions verified / total number of persistent XSS vulnerable sessions to verify. When persistent XSS auditing is enabled, Fortify WebInspect sends a second request to all vulnerable sessions and examines all responses for probes that Fortify WebInspect previously made. When probes are located, Fortify WebInspect will record links between those pages internally.

Reflection Audited

Number of persistent XSS vulnerable linked sessions audited / total number of persistent XSS vulnerable linked sessions to audit. When persistent XSS auditing is enabled, this represents the work required for auditing the linked sessions found in the verification step for persistent XSS.

[bn_pep]

Hello, I do understand what they represent. I've never found a way to enable these checks. The auditing for these two progress bars is always zero for our scans. How to I enable these tests? I can't find anything in the scan settings. Are they enabled via a policy, or some other means?

[ebell · Accepted solution]

Persistent is not enabled by default in the Standard policy. If you change the policy to Cross-Site Scripting (or enable in the Standard Policy) you will see values...as long as the site is vulnerable as well:

Here is a screenshot of the Standard policy showing where this is disabled:

 

[bn_pep]

So, it's enabled in the policy. Thanks! That is what I needed to know!